214 matches found
The Open ISES Project 3.30A - tick_lat SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: The Open ISES Project 3.30A - 'ticklat' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://openises.sourceforge.net/ Software Link: https://sourceforge.net/projects/openises/files/latest/download Version:...
humum.net XSS vulnerability
Open Bug Bounty ID: OBB-661493 Description| Value ---|--- Affected Website:| humum.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
kowollik.net XSS vulnerability
Open Bug Bounty ID: OBB-661164 Description| Value ---|--- Affected Website:| kowollik.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
sbestway.com XSS vulnerability
Open Bug Bounty ID: OBB-641177 Description| Value ---|--- Affected Website:| sbestway.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Code injection
DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...
CVE-2018-6022: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter...
CVE-2012-6671: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creating a new monster, allow remote attackers to inject arbitrary web script or HTML via the 1 monstertitle or 2 monsterdescription parameters...
fodesco.fi XSS vulnerability
Vulnerable URL: https://www.fodesco.fi/main.php?sub=shop"'--!alert/Y4R4G/...
soprassub.com XSS vulnerability
Vulnerable URL: http://soprassub.com/new/main.php?pg=03⊂cat=x"'--!alert/Y4R4G/...
CVE-2017-0378
XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...
Cross site scripting
XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...
CVE-2017-0378
XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...
CVE-2017-0378
Removed by vendor...
leesandwiches.com XSS vulnerability
Vulnerable URL: http://www.leesandwiches.com/main.php?act=productlist=1/-///'/"//--...
WordPress Plugin WA Form Builder SQL Injection
Description: Type user access: any user. $POST ‘waformsId’ is not escaped. WAFormBuilderuioutput is accessible for any user. File / Code: Path: /wp-content/plugins/wa-form-builder/main.php global $wpdb; echo 'SELECT FROM '.$wpdb-prefix.'wapwaformbuilder WHERE Id = '.$REQUEST'waformsId'; $formattr...
elevdelta.dk XSS vulnerability
Vulnerable URL: http://www.elevdelta.dk/main.php?v=1.09=math=regnomaten.swf=-1=3=%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E=buttlar⊂=crew〈=en Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...
ifs-denmark.com XSS vulnerability
Vulnerable URL: http://ifs-denmark.com/main.php?id=services"'--!confirmOPENBUGOUNTY//...
vhs-swiss.com XSS vulnerability
Vulnerable URL: http://vhs-swiss.com/main.php?id=services"'--!confirmOPENBUGBOUNTY//...